Pipewire/wireplumber

policy/modules/apps/pipewire.fc

@@ -1,5 +1,6 @@
 # PipeWire daemon executable.
 /usr/bin/pipewire		--	gen_context(system_u:object_r:pipewire_exec_t,s0)
+/usr/bin/wpctl		--	gen_context(system_u:object_r:pipewire_exec_t,s0)
 
 # pw-cat is a standalone client utility (plays/captures audio via a running
 # PipeWire daemon); it runs in pipewire_client_t, not pipewire_t.

policy/modules/apps/wireplumber.fc

@@ -0,0 +1,9 @@
+HOME_DIR/\.config/wireplumber(/.*)?	gen_context(system_u:object_r:wireplumber_home_t,s0)
+HOME_DIR/\.local/share/wireplumber(/.*)?	gen_context(system_u:object_r:wireplumber_home_t,s0)
+
+/run/wireplumber(/.*)?		gen_context(system_u:object_r:wireplumber_runtime_t,s0)
+/run/user/%{USERID}/wireplumber(/.*)?	gen_context(system_u:object_r:wireplumber_runtime_t,s0)
+
+/usr/bin/wireplumber		--	gen_context(system_u:object_r:wireplumber_exec_t,s0)
+
+/var/lib/wireplumber(/.*)?		gen_context(system_u:object_r:wireplumber_var_lib_t,s0)

policy/modules/apps/wireplumber.if

@@ -0,0 +1,45 @@
+## <summary>Policy for WirePlumber, the PipeWire session manager.</summary>
+
+########################################
+## <summary>
+##	Connect to WirePlumber over a unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`wireplumber_stream_connect',`
+	gen_require(`
+		type wireplumber_t, wireplumber_runtime_t;
+	')
+
+	files_search_runtime($1)
+	stream_connect_pattern($1, wireplumber_runtime_t, wireplumber_runtime_t, wireplumber_t)
+')
+
+########################################
+## <summary>
+##	Role access for WirePlumber in user-service mode.
+## </summary>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	User domain for the role.
+##	</summary>
+## </param>
+#
+interface(`wireplumber_role',`
+	gen_require(`
+		type wireplumber_t, wireplumber_exec_t;
+		attribute_role wireplumber_roles;
+	')
+
+	roleattribute $1 wireplumber_roles;
+	domtrans_pattern($2, wireplumber_exec_t, wireplumber_t)
+')

policy/modules/apps/wireplumber.te

@@ -0,0 +1,138 @@
+policy_module(wireplumber)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role wireplumber_roles;
+
+type wireplumber_t;
+type wireplumber_exec_t;
+ifdef(`wireplumber_system_service',`
+	init_daemon_domain(wireplumber_t, wireplumber_exec_t)
+',`
+	userdom_user_application_domain(wireplumber_t, wireplumber_exec_t)
+	role wireplumber_roles types wireplumber_t;
+')
+
+type wireplumber_home_t alias wireplumber_var_lib_t;
+userdom_user_home_content(wireplumber_home_t)
+
+type wireplumber_runtime_t;
+files_runtime_file(wireplumber_runtime_t)
+
+type wireplumber_tmpfs_t;
+userdom_user_tmpfs_file(wireplumber_tmpfs_t)
+
+########################################
+#
+# Local policy
+#
+
+allow wireplumber_t self:process { getsched setsched signal signull };
+allow wireplumber_t self:capability sys_nice;
+allow wireplumber_t self:fifo_file rw_fifo_file_perms;
+allow wireplumber_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow wireplumber_t self:unix_dgram_socket create_socket_perms;
+
+# Bluetooth socket (for BlueZ audio routing)
+allow wireplumber_t self:bluetooth_socket { create bind setopt listen };
+
+# netlink kobject uevent socket (for udev device monitoring)
+allow wireplumber_t self:netlink_kobject_uevent_socket { create bind setopt getattr getopt };
+
+dev_read_sysfs(wireplumber_t)
+
+# /dev/snd inotify watch for device monitoring
+dev_watch_dev_dirs(wireplumber_t)
+
+# filesystem getattr
+dev_getattr_fs(wireplumber_t)
+fs_getattr_xattr_fs(wireplumber_t)
+
+# v4l device getattr (video device enumeration)
+dev_dontaudit_getattr_video_dev(wireplumber_t)
+
+files_read_usr_files(wireplumber_t)
+files_map_usr_files(wireplumber_t)
+files_read_etc_files(wireplumber_t)
+
+# /etc/machine-id
+files_read_etc_runtime_files(wireplumber_t)
+
+kernel_read_system_state(wireplumber_t)
+
+domain_dontaudit_read_all_domains_state(wireplumber_t)
+
+logging_send_syslog_msg(wireplumber_t)
+
+miscfiles_read_localization(wireplumber_t)
+
+# Connect to PipeWire runtime socket
+optional_policy(`
+	pipewire_stream_connect(wireplumber_t)
+')
+
+# Use file descriptors passed from PipeWire (e.g. memfd)
+optional_policy(`
+	pipewire_use_fds(wireplumber_t)
+')
+
+# Access PipeWire tmpfs shared memory (memfd zero-copy buffers)
+optional_policy(`
+	pipewire_rw_tmpfs_files(wireplumber_t)
+')
+
+# Runtime directory management - differs between system and user service
+ifdef(`wireplumber_system_service',`
+	files_var_lib_filetrans(wireplumber_t, wireplumber_home_t, { dir file })
+	files_runtime_filetrans(wireplumber_t, wireplumber_runtime_t, { dir file sock_file })
+',`
+	userdom_user_runtime_filetrans(wireplumber_t, wireplumber_runtime_t, dir)
+	userdom_user_home_dir_filetrans(wireplumber_t, wireplumber_home_t, dir)
+')
+
+# tmpfs shared memory (memfd for zero-copy audio buffers)
+mmap_manage_files_pattern(wireplumber_t, wireplumber_tmpfs_t, wireplumber_tmpfs_t)
+fs_tmpfs_filetrans(wireplumber_t, wireplumber_tmpfs_t, file)
+
+# udev runtime data (/run/udev)
+udev_search_runtime(wireplumber_t)
+udev_read_runtime_files(wireplumber_t)
+
+# systemd sessions (/run/systemd/sessions)
+systemd_read_logind_sessions_files(wireplumber_t)
+systemd_watch_logind_sessions_dirs(wireplumber_t)
+
+optional_policy(`
+	dbus_system_bus_client(wireplumber_t)
+	dbus_connect_system_bus(wireplumber_t)
+
+	ifdef(`wireplumber_system_service',`
+		dbus_system_domain(wireplumber_t, wireplumber_exec_t)
+	')
+')
+
+# Allow ModemManager D-Bus replies to wireplumber_t
+optional_policy(`
+	modemmanager_dbus_chat(wireplumber_t)
+')
+
+# Allow BlueZ D-Bus signals to wireplumber_t
+optional_policy(`
+	bluetooth_dbus_chat(wireplumber_t)
+')
+
+# Allow oFono D-Bus communication (telephony)
+optional_policy(`
+	ofono_dbus_chat(wireplumber_t)
+')
+
+optional_policy(`
+	rtkit_scheduled(wireplumber_t)
+')
+
+optional_policy(`
+	systemd_read_journal_files(wireplumber_t)
+')

policy/modules/services/ofono.if

@@ -7,3 +7,29 @@
 ##
 ## https://git.kernel.org/pub/scm/network/ofono/ofono.git
 ## </desc>
+
+########################################
+## <summary>
+##	Allow D-Bus communication with oFono.
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to send and receive D-Bus
+##	messages to/from oFono for telephony audio routing.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ofono_dbus_chat',`
+	gen_require(`
+		type ofono_t;
+		class dbus send_msg;
+	')
+
+	allow $1 ofono_t:dbus send_msg;
+	allow ofono_t $1:dbus send_msg;
+')